1. Field of the Invention
This invention relates to the field of communications, and in particular to secure communications via an IEEE 1394 (firewire) interface.
2. Description of Related Art
Secure communications between and among devices is becoming increasingly important for the protection of copyright material and other communiqués. An organization known as the Digital Transmission Licensing Authority (DTLA) has created the Digital Transmission Content Protection Specification, commonly known as the “5C” specification. The 5C specification defines a cryptographic system comprising a number of cryptographic components, including methods for enciphering and deciphering content material, and methods for determining secure cryptographic keys for use in this enciphering and deciphering of the content material.
A commonly used protocol for the transmission of audio/visual material among audio/visual applications is the IEEE 1394 protocol and interface. Special purpose controllers have been developed to support the transfer of enciphered material between an application program and the IEEE 1394 bus interface, including the enciphering and deciphering of the content material being transferred in accordance with the 5C specification, based on cryptographic keys that are provided by the application program. As is known in the art, given a sufficiently robust key, the enciphering and deciphering of information can provide a high level of security, and can be effected with relatively little overhead, being based primarily on a “shift and add” or similar operation. The complexity required to generate the keys that are used to perform the enciphering and deciphering, on the other hand, is substantial. To minimize the potential damage caused by a breach of security of keys, the 5C specification calls for the generation of unique keys by the devices involved in the transfer of the information. A discovery of the keys that are used by one pair of devices provides no information concerning the keys used by another pair of devices. When a communication of protected information is required, the devices generate a unique set of keys for ciphering and deciphering the information. The generation of unique keys for each session of information transfer is effected via a “key exchange”, which is an exchange of parameters that are used to generate keys within each device.
In the 5C specification, an elliptic curve Diffie-Hellman key exchange, and an elliptic curve Digital Signature algorithm is specified for full authentication. The elliptic curve computations are known in the art, and are mathematically complex. For sufficient security, the computations use relatively large numbers, in the order of 160 or more bits. The 5C specification requires that these operations be completed in a limited amount of time, for operation effectiveness, as well as security reasons. Because of the mathematical complexity and required efficiency, a conventional implementation of these tasks includes a software program that is executed on a high-performance microprocessor. For example, on a home computer system with an IEEE 1394 interface, the application program that is used to transfer the information to other devices contains the sub-programs that compute or verify digital signatures, and, if the signatures are verified, effect a key exchange. These sub-programs are typically run on a Pentium® or similar high performance processor, via, for example, a “C” program that includes complex operations that are known to be computationally irreversible. That is, a knowledge of the output of the complex operation provides little or no information regarding the parameters that were used to generate the output. For example, in the context of the 5C specification, elliptic curve cryptography is based on a determination of a point on an elliptic curve based on another point on the curve.
As the name “key exchange” implies, both the device that will be transmitting the protected information, and the device that will be receiving the protected information must participate in this exchange, and therefore both devices must contain sufficient capabilities to effect the above described key exchange computations. Although the execution of a key exchange on a home computer is feasible, the cost of a high performance microprocessor can be prohibitive in many applications, specifically consumer electronic equipment, such as video recorders, CD players, and the like. Additionally, each application program on a computer, and each component device that is expected to comply with the 5C specification, must incur the cost of developing and testing, or purchasing and testing, the software required to effect the digital signing and key exchange tasks required by the 5C specification. As an alternative to a high-performance processor running a software program, a special purpose processor can be provided to facilitate the 5C authentication functions, but such a special purpose processor can be expected to require a substantial modification to existing processing systems designs and architectures, and will add costs to each device that is expected to comply with the 5C specification.